| 1 |
|
Introduction |
| 2 |
|
------------ |
| 3 |
|
|
| 4 |
< |
HOPM (Hybrid Open Proxy Monitor) is an open proxy monitoring bot designed for |
| 5 |
< |
Hybrid based ircds. The bot is designed to monitor an individual server (all |
| 6 |
< |
servers on the network have to run their own bot) with a local operator {} |
| 7 |
< |
block and monitor connections. When a client connects to the server, HOPM will |
| 8 |
< |
scan the connection for insecure proxies. Insecure proxies are determined by |
| 9 |
< |
attempting to connect the proxy back to another host (usually the IRC server in |
| 10 |
< |
question). |
| 4 |
> |
HOPM (Hybrid Open Proxy Monitor) is an open proxy monitoring bot designed to |
| 5 |
> |
monitor an individual server (all servers on the network have to run their own |
| 6 |
> |
bot if the IRCD doesn't support 'farconnect' user mode) with a local |
| 7 |
> |
operator {} block and monitor connections. When a client connects to a server, |
| 8 |
> |
HOPM will scan the connection for insecure proxies. Insecure proxies are |
| 9 |
> |
determined by attempting to connect the proxy back to another host (usually the |
| 10 |
> |
IRC server in question). |
| 11 |
|
|
| 12 |
< |
HOPM is written ground-up in C language, concept derived from wgmon. It |
| 12 |
> |
HOPM is written ground-up in C language and it is an improved fork of BOPM |
| 13 |
> |
(blitzed open proxy monitor) which is a concept derived from wgmon. It |
| 14 |
|
improves on wgmon with HTTP support, faster scanning (it can scan clients |
| 15 |
< |
simultaneously), better layout (scalability), and dnsbl support. |
| 15 |
> |
simultaneously), better layout (scalability), and DNSBL support. |
| 16 |
|
|
| 17 |
|
|
| 18 |
|
Requirements |
| 19 |
|
------------ |
| 20 |
|
|
| 21 |
< |
o An IRCd which presents connection notices in a format which HOPM |
| 21 |
> |
o An IRCD which presents connection notices in a format which HOPM |
| 22 |
|
recognises (see below). |
| 23 |
|
|
| 24 |
|
o A host with full connectivity for all the ports you wish to scan. i.e. is |
| 34 |
|
Compatibility |
| 35 |
|
------------- |
| 36 |
|
|
| 37 |
< |
ircd-hybrid 8.2.1 |
| 38 |
< |
|
| 39 |
< |
HOPM is designed for ircd-hybrid based ircds. It is easily suitable for any |
| 40 |
< |
other ircd with little modification (connregex in hopm.conf). However, if an |
| 41 |
< |
ircd does not send IP addresses in a connection notice, HOPM will not be |
| 42 |
< |
effective because the time it takes to resolve a hostname would be a |
| 43 |
< |
significant factor to HOPM's efficiency. |
| 37 |
> |
ircd-hybrid 8.2.x |
| 38 |
> |
ircd-ratbox 3.0.x |
| 39 |
> |
ircu 2.10.x |
| 40 |
> |
InspIRCd 2.0.x |
| 41 |
> |
UnrealIRCd 3.2.x |
| 42 |
> |
ngIRCd 22 |
| 43 |
> |
Bahamut 2.0.x |
| 44 |
> |
Charybdis 3.4.x |
| 45 |
> |
|
| 46 |
> |
HOPM is easily suitable for any other IRCD with little modification (connregex |
| 47 |
> |
in hopm.conf). However, if an IRCD does not send IP addresses in a connection |
| 48 |
> |
notice, HOPM will not work. |
| 49 |
|
|
| 50 |
|
|
| 51 |
|
Command Line Options |
| 52 |
|
-------------------- |
| 53 |
|
|
| 54 |
< |
-c <name> Config name. By default HOPM reads hopm.conf, "-c foo" |
| 55 |
< |
will cause HOPM to read foo.conf. The primary use for |
| 56 |
< |
this is to run multiple HOPMs from one directory. |
| 54 |
> |
-c <name> Config name. By default HOPM reads hopm.conf, "-c foo" |
| 55 |
> |
will cause HOPM to read foo.conf. The primary use for |
| 56 |
> |
this is to run multiple HOPMs from one directory. |
| 57 |
|
|
| 58 |
< |
-d Debug mode. HOPM will not fork, and will write logs to stderr. |
| 59 |
< |
Multiple -d increase debug level. |
| 58 |
> |
-d Debug mode. HOPM will not fork, and will write logs to stderr. |
| 59 |
> |
Multiple -d increase debug level. |
| 60 |
|
|
| 61 |
|
|
| 62 |
|
Operator Channel Commands |
| 63 |
|
------------------------- |
| 64 |
|
|
| 65 |
|
botnick check <host> [scanner] -- Manually scan host for insecure proxies and output all errors. |
| 66 |
< |
If scanner is not given, hopm will scan on all scanners. |
| 66 |
> |
If scanner is not given, HOPM will scan on all scanners. |
| 67 |
|
NOTE: this will NOT add a kline (or whatever) if it finds a |
| 68 |
|
proxy. |
| 69 |
|
|
| 70 |
|
botnick stats -- Output scan stats, uptime and client connection count. |
| 71 |
|
|
| 72 |
< |
botnick fdstat -- Output some into about file descriptors in use. |
| 72 |
> |
botnick fdstat -- Output some info about file descriptors in use. |
| 73 |
|
|
| 74 |
|
Also if several HOPMs are present in one channel they will all respond to !all, |
| 75 |
|
for example !all stats. |
| 78 |
|
Rehashing HOPM |
| 79 |
|
-------------- |
| 80 |
|
|
| 81 |
< |
A /kill to hopm will cause the process to restart, rehashing the configuration file |
| 82 |
< |
and ending all queued scans. |
| 81 |
> |
A /quote KILL to HOPM will cause the process to restart, rehashing the |
| 82 |
> |
configuration file and ending all queued scans. |
| 83 |
|
|
| 84 |
|
|
| 85 |
|
Logging |